---
id: CVE-2025-32962
aliases:
  - GHSA-99pm-ch96-ccp2
  - PYSEC-2026-1379
title: Flask-AppBuilder open redirect vulnerability using HTTP host injection
summary: Flask-AppBuilder open redirect vulnerability using HTTP host injection
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
vendor: flask-appbuilder
product: flask-appbuilder
ecosystem: pip
affected:
  - flask-appbuilder < 4.6.2
patched:
  - flask-appbuilder 4.6.2
published: '2025-05-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:57.462278194Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-99pm-ch96-ccp2'
references:
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-99pm-ch96-ccp2
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-32962'
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/commit/32eedbbb5cb483a3e782c5f2732de4a6a650d9b6
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder'
tags:
  - osv
  - pip
epss: 0.0022
epssPercentile: 0.11197
ingestedAt: '2026-07-08T18:25:47.806Z'
---

## Overview

### Impact
Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests.
 
### Patches
Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection.

Examples:
```
FAB_SAFE_REDIRECT_HOSTS = ["yourdomain.com", "sub.yourdomain.com", "*.yourcompany.com"]
```

### Workarounds
Use a Reverse Proxy to Enforce Trusted Host Headers

### References
_Are there any links users can visit to find out more?_

## Affected packages

- `flask-appbuilder < 4.6.2`

## Remediation

Upgrade to a patched release:

- `flask-appbuilder 4.6.2`